AI-generated medical deepfakes can fool radiologists and AI models alike. The only durable defence is trust you cannot fake, with cryptographic provenance baked into every digital artefact at the moment of creation.
In this article
- The threat is already here: deepfake radiology
- Adversarial attacks on AI diagnostics
- Blockchain as a trust layer for medical imaging
- Zero knowledge proofs: proving authenticity without exposing data
- How a cryptographically trusted imaging pipeline works
- The AI-blockchain convergence imperative
- The Sedicii binding mechanism: how it works
- Where Sedicii fits
A radiologist in 2026 sits down to review a chest X-ray. The image looks clinically normal. The patient, however, has early-stage lung cancer, but that evidence was algorithmically erased before the file reached the hospital’s PACS system. Or consider the reverse: a fabricated tumour inserted into a clean scan to trigger unnecessary surgery. Both scenarios are now technically feasible. Neither requires nation-state resources. Both are nearly undetectable without cryptographic provenance.
This is not science fiction. It is the logical endpoint of a capability that already exists and is already being studied in peer-reviewed literature. The question is not whether medical imaging data will be targeted. It is whether the healthcare sector will build trust infrastructure before the first provable harm occurs. This is ultimately about patient safety and insisting that the device manufacturers make it a top priority.
The answer, increasingly, lies at the intersection of three technologies: blockchain, zero knowledge proofs (ZKPs), and the AI systems that generate the threat in the first place.
The threat is already here: deepfake radiology
In March 2026, the Radiological Society of North America published a landmark study in Radiology that should alarm every healthcare CISO, clinical governance lead, medical AI vendor and clinician. Researchers found that neither trained radiologists nor state-of-the-art multimodal large language models could reliably distinguish AI-generated deep-fake X-ray images from authentic clinical images.
When radiologists were not told synthetic images were present, only 41% spontaneously identified any AI-generated images at all. Even when explicitly warned, mean accuracy was just 75%, and individual radiologist performance ranged from 58% to 92%. The AI models fared no better: GPT-4o, GPT-5, Gemini 2.5 Pro, and Llama 4 Maverick achieved detection rates of only 57% to 85%.
The study’s lead author, Dr. Mickael Tordjman of the Icahn School of Medicine at Mount Sinai, warned that we are potentially only seeing the tip of the iceberg, and that the logical next step is AI generation of synthetic 3D images, including CT and MRI scans.
Separately, a 2025 Nature Scientific Reports study documented the threat in MRI specifically, evaluating a dataset of 1,378 brain MRI scans, 604 of which had been manipulated to insert or remove tumours. The paper describes AI-generated medical deepfakes involving tumour insertions and removals in diagnostic scans as a direct threat to patient safety and healthcare integrity.
The attack surface is expanding. Generative AI models that previously required specialist knowledge to deploy, including diffusion models, generative adversarial networks, and multimodal LLMs, are now mass-market consumer products. GPT-4o, released in 2025, was the first such model accessible to the general public that could generate anatomically plausible radiographs from a plain-language prompt. The technical barrier to fabricating a medical image has, in practical terms, collapsed.
Adversarial attacks on AI diagnostics: a separate but compounding risk
Deepfake images, meaning outright fabrications, are only one half of the threat model. The other is adversarial attacks: imperceptible pixel-level manipulations of authentic images that cause AI diagnostic systems to misclassify them while appearing visually normal to human observers.
A comprehensive 2025 review in Diagnostic and Interventional Imaging from the University of Toronto catalogued the clinical implications across radiology tasks. The findings are sobering. In MRI brain segmentation tasks, adversarial perturbations reduced average Dice overlap scores from the 0.84 to 0.86 range on clean data to as low as 0.45, rendering AI-assisted segmentation effectively unusable. The Dice score (or Sørensen–Dice coefficient) is a statistical metric used to measure the similarity or overlap between two sets of data, ranging from 0 (no overlap) to 1 (perfect overlap). In CT lung cancer screening, adversarial perturbations were shown to add or remove evidence of malignancy, directly altering clinical interpretation.
“As AI systems become more integrated into clinical practice, new concerns have emerged regarding their vulnerability to adversarial attacks.” — Dietrich et al., Diagnostic and Interventional Imaging, 2025
These attacks operate at the model level, not just the file level. A pristine, unmanipulated DICOM file fed into a compromised or adversarially targeted AI diagnostic system can produce a manipulated output even if the source image itself is authentic. This means the integrity problem has two distinct layers: the authenticity of the image file, and the integrity of the inference pipeline that processes it.
Cryptographic trust must address both.
Blockchain as a tamper-evident trust layer for medical imaging
Blockchain’s core value proposition in this context is not as a storage medium. Storing multi-gigabyte MRI datasets on-chain would be prohibitively expensive and slow. Rather, blockchain provides an immutable, decentralised ledger for recording the cryptographic hash of an image at the moment of its creation.
A cryptographic hash is a fixed-length fingerprint of a file. Change a single pixel and the hash changes entirely. Store that hash on a blockchain, where it becomes part of an immutable, timestamped, distributed record, and you have created an unforgeable certificate of what the image contained at a specific moment in time.
A 2025 MDPI study introduced exactly this architecture for medical imaging: a zero-trust medical image sharing framework using SHA-256 hashes of medical images and associated metadata recorded on-chain, with the images themselves stored off-chain in IPFS (the InterPlanetary File System), a peer-to-peer, decentralised storage network. The system provides three properties simultaneously: immutability of the hash record, confidentiality of the image itself, and verifiability of any subsequent comparison.
How on-chain hashing works in practice: When a scanner produces an MRI, the DICOM file is hashed immediately, before transmission and before any downstream processing. A DICOM (Digital Imaging and Communications in Medicine) file is the global standard format for storing and transmitting medical images, such as X-rays, CT scans, and MRIs. That hash is committed to the blockchain alongside a timestamp and the identity of the originating device. At any future point, anyone with access to the image and the blockchain record can recompute the hash and verify that the file has not been altered. A manipulated image will produce a different hash and fail verification instantly.
The MediChainAI framework, published in Bioengineering in November 2025, extended this model by integrating Self-Sovereign Identity (SSI), allowing patients to retain cryptographic control over their own health data, granting and revoking access programmatically. Merkle-proof-based validation provides authenticity and non-repudiation for selectively shared records, meaning individual imaging records can be verified without exposing the broader dataset.
The critical insight from all of this research is consistent: centralised identity and data management systems represent a single point of failure. Healthcare data breaches, with over 133 million records exposed in the US alone in 2023, are largely a consequence of centralisation. Decentralisation through blockchain removes that single point of failure while simultaneously creating the immutable audit trail that healthcare governance requires.
Zero knowledge proofs: proving authenticity without exposing sensitive data
Blockchain solves the tamper-evidence problem. But healthcare creates a second, equally important problem: how do you verify that a medical image is authentic, that a patient’s record is valid, or that a clinician is authorised, without revealing the underlying data to the verifying party?
This is the precise problem that zero knowledge proofs were designed to solve.
A ZKP is a cryptographic method that allows one party (the prover) to demonstrate to another party (the verifier) that a statement is true, without revealing any information about why it is true beyond the fact of its truth. In mathematical terms: the verifier learns nothing except that the proof is valid.
A ZKP could enable verification of medical data validity in under 300 milliseconds with small proof sizes, compact enough for real-time clinical workflows.
Practical applications of ZKPs in medical imaging trust:
- Image provenance. Prove that an MRI was produced by a specific licensed scanner at a certified facility, without revealing patient identity or scan metadata to the verifying party.
- Clinical authorisation. Prove that a clinician accessing an imaging record holds valid credentials and authorisation, without exposing their identity or patient relationship to a third-party audit system.
- Consent verification. Prove that a patient has granted consent for a specific use of their imaging data, without disclosing the nature of the data or the identity of the research institution receiving it.
- Cross-institution sharing. Prove that a transferred imaging record matches the hash registered at the originating institution, without either party revealing their internal patient identifiers.
The HealthChain framework (2025, Journal of Cyber Security Technology) combined ZKPs with facial recognition biometrics to create a dual-layer access control system: biometric identity verified without storing raw biometric data, and access credentials verified without revealing private keys. The system authenticates users without ever disclosing the data that authenticates them, which is a critical distinction for GDPR and HIPAA compliance alike.
How a cryptographically trusted imaging pipeline works end-to-end
Combining blockchain hashing with ZKPs and decentralised storage creates a complete provenance architecture. Here is how a production implementation would function:
- Capture and immediate hashing. The scanner produces the image. Before any transmission, a cryptographic hash (SHA-256 or equivalent) is computed on-device. This hash is the image’s unique fingerprint at the moment of authentic creation.
- Blockchain registration. The hash, timestamp, scanner DID (Decentralised Identifier), and facility credentials are written to the blockchain via a smart contract. This record is immutable and publicly verifiable without revealing the image contents.
- Off-chain storage with encryption. The image itself is encrypted using the patient’s public key (elliptic curve cryptography) and stored on IPFS or an equivalent content-addressed storage system. Only the patient, or parties they authorise, can decrypt it.
- ZKP-gated access. When a clinician requests access, a ZKP is generated proving they hold valid credentials and patient consent, without revealing who they are or what the consent covered to anyone outside the authorised parties.
- Verification at every downstream step. Every time the image is accessed, whether by a radiologist, an AI diagnostic system, a second opinion service, or a research platform, the hash is recomputed and verified against the blockchain record. Any tampering is immediately detected.
- Immutable audit trail. Every access event is recorded on-chain as an immutable transaction, creating a complete, tamper-proof chain of custody from scanner to clinician to archive, satisfying regulatory requirements and enabling forensic analysis if a breach occurs.
The AI-blockchain convergence imperative: a broader principle
Medical imaging is one of the clearest illustrations of a broader principle that applies across every domain where AI generates, analyses, or transforms high-stakes digital artefacts: any digital artefact you need to trust must have cryptographically provable trust embedded into it as a consequence of the AI system that touched it or might have touched it.
This principle extends far beyond healthcare. Consider:
Legal evidence. AI-enhanced or AI-analysed CCTV footage, forensic images, and digital documents are increasingly submitted as legal evidence. Without cryptographic provenance, any such artefact is vulnerable to challenge and fabrication.
Critical infrastructure. IoT sensor data from energy grids, water treatment facilities, and industrial control systems is increasingly AI-processed. Adversarial manipulation of sensor readings, feeding false data into AI monitoring systems, represents a critical attack surface that blockchain-anchored provenance would substantially close.
Financial services. AI-generated financial models, valuations, and compliance outputs carry regulatory weight. Blockchain-based audit trails for AI inference, recording what model, what version, what training data, and what inputs produced what output, are rapidly becoming a regulatory expectation.
Identity documents. AI is now capable of generating photorealistic identity documents, biometric likenesses, and a whole raft of supporting records. Cryptographic provenance embedded at the point of authentic document creation, controlled by the issuing authorities, is a scalable defence against AI-generated identity fraud at scale.
The convergence of AI and blockchain is not a technical curiosity. It is an emerging infrastructure requirement. As AI lowers the cost of fabricating any digital artefact to near zero, an economically sustainable response is to make authentic artefacts cryptographically self-evidencing. Trust must be an intrinsic property of the artefact, not an extrinsic assertion about it.
Research published in the Journal of Multidisciplinary Knowledge in 2025 found that blockchain-assisted AI data integrity frameworks reduced provenance disputes by 92% and improved audit efficiency by 41% compared to conventional approaches, with minimal performance impact from parallelised validation nodes.
Where Sedicii fits: zero knowledge proof cryptography as the foundation layer
Sedicii’s core technology, zero knowledge proofs, sits at the foundation of every architecture described in this article. The specific imaging binding described above is one concrete instantiation of a broader capability: the ability to attach cryptographically verifiable proofs of genuine provenance to any digital artefact, at the moment of creation, in a form that any third party can verify without accessing the underlying data.
When a radiologist accesses an imaging record, what the system needs to know is: does this person have valid credentials, and have they been granted access by an authorised party? It does not need to know their name, their employer, or their patient relationship. A ZKP proves the credential claim without disclosing the credential.
When an AI diagnostic system processes an image, what the audit trail needs to record is: the result of the check to confirm that this is the authentic image as registered at creation, and was the AI system processing it the version attested to by its developer? A blockchain-anchored ZKP proves both claims without exposing the patient’s data or the vendor’s proprietary model architecture.
The healthcare sector is not the only one that needs this. It is simply the one where the consequences of getting it wrong are most immediately measurable in human harm. The same binding mechanism applies to any domain where a digital artefact must be trusted, including legal evidence, financial models, identity documents, AI Agents and infrastructure sensor data.
As AI capabilities continue to advance, and as the tools to fabricate convincing medical images, legal documents, financial records, and identity credentials become more accessible, the organisations that will maintain trust are those that build cryptographic provenance into their digital infrastructure now, before the first undetectable forgery causes irreversible harm.
The technology exists. The research is maturing. The regulatory pressure is building. The question for every organisation that handles high-stakes digital artefacts is not whether cryptographic trust infrastructure is necessary. It is whether they will build it before they need it, or will it be left until after a catastrophe has happened.
Sources: Tordjman et al., Radiology (2026); Dietrich et al., Diagnostic and Interventional Imaging (2025); MDPI Zero-Trust Medical Image Sharing (2025); MediChainAI, Bioengineering (2025); ZKP Healthcare Protocol, JTIE (2025); HealthChain, Journal of Cyber Security Technology (2025); Nature Scientific Reports, Wearable ZKP (2025); ScienceDirect STARKs for Anonymous Authentication (2025); Journal of Multidisciplinary Knowledge Blockchain-AI Integrity (2025); PMC Genomic ZKP Framework (2025).